In July 2026 Vietnam's Ministry of Public Security issued Circular No. 48/2026/TT-BCA, publishing national technical regulation QCVN 11:2026/BCA, "Surveillance camera equipment using internet protocol – Baseline cybersecurity requirements", in force from 1 July 2026. The regulation repeals QCVN 135:2024/BTTTT of the former Ministry of Information and Communications, and IP camera equipment now falls directly under the supervision of the Ministry of Public Security. The regulation was drafted under the leadership of the ministry's Department of Cybersecurity and High-Tech Crime Prevention, and is based on Vietnam's newly revised Cybersecurity Law of 2025.

Scope and obliged parties

The regulation applies to IP surveillance camera equipment produced and distributed in Vietnam, and must be observed by domestic and foreign manufacturers and businesses, including importers. Chinese manufacturers and exporters are therefore also obliged parties: whether products enter the Vietnamese market as complete units, semi-finished goods or components, they must be assessed to determine whether they fall within scope.

Technical requirements

The technical content of the regulation references ETSI EN 303 645, the baseline standard for consumer IoT cybersecurity, together with its supporting assessment standard ETSI TS 103 701. It sets out eleven groups of mandatory requirements and specifies a test method for each:

1. Unique initial password: devices must be shipped with unique initial credentials; universal default passwords are prohibited;

2. Vulnerability management: a mechanism for discovering, assessing and remediating vulnerabilities;

3. Update management: security updates that can be verified and delivered sustainably;

4. Storage of sensitive security parameters: keys, credentials and similar sensitive parameters must be stored securely;

5. Secure communication channels: encryption and authentication mechanisms for network communication;

6. Protection of external interfaces against attack;

7. User data protection: personal and user data handled on the principle of minimisation;

8. Resilience to failure: the system can automatically return to a secure state after an abnormal condition;

9. Data deletion: users can securely delete their data;

10. Input validation: external inputs are validated to prevent injection-type attacks;

11. On-device data protection: locally stored data must be protected for integrity.

Conformity assessment

For conformity assessment, camera equipment in the medium and high risk categories managed by the Ministry of Public Security must complete a compliance declaration and bear the CR mark. Medium-risk equipment may be self-assessed on the basis of results from designated laboratories or recognised foreign assessment bodies, while high-risk equipment must be certified by a designated certification body under Method 5 or Method 7. This obligation applies only once the ministry publishes its catalogue of medium and high risk products, and the timing of that publication will effectively determine the implementation timetable.

Impact on exporters and recommendations

Vietnam is an important export market for Chinese security and surveillance products, and Chinese brands hold a major local share. For companies whose designs already comply with ETSI EN 303 645, the technical gap should be manageable and the main effort will be in local procedural alignment. We recommend carrying out a gap assessment against the eleven groups of requirements, preparing the IXIT technical documentation and vulnerability management system documents, and closely tracking publication of the risk product catalogue and the list of designated assessment bodies.

Click for more on Vietnamese market access regulations:

Vietnam's MST publishes rules for wireless access devices in the 6 GHz band

Vietnam issues a mandatory security standard for IP cameras, giving companies a one-year transition period

Vietnam's Ministry of Science and Technology opens the 6 GHz band for Wi-Fi

Vietnam's MIC publishes a draft plan for the 6 GHz band for Wi-Fi 6E and Wi-Fi 7

Vietnam publishes a draft national technical regulation for electric vehicle charging piles